📝Tool Poisoning is an attack on AI agents in which a malicious tool hides instructions in its description or schema, text the model reads as trusted context but the user typically never sees.
Agents connected through the 📝Model Context Protocol (MCP) receive each tool's name, description, and parameter schema as part of their context. A poisoned 📝MCP Server places instructions in those fields, such as directions to read private files and pass their contents out through a tool argument, while the visible summary looks harmless. The agent follows them because it cannot distinguish them from legitimate guidance.
Invariant Labs named and demonstrated the attack in April 2025, alongside two variants: rug pulls, in which a server changes a tool's description after the user approved it, and shadowing, in which one server's description alters how the agent uses another server's tools. Later research extended poisoning to every schema field and to tool outputs.
Defenses are layered rather than single. Common measures include installing only vetted servers, scanning and hash-pinning tool definitions so changes are detected, limiting the permissions and data any agent can reach, and requiring confirmation for sensitive actions. Sandboxing the server's code does not help, because the attack works through the model's instruction-following rather than the server's execution.